EvilClippy

该工具在我们于BlackHat Asia大会（2019年3月28日）上的演讲中发布。该演讲的视频录像可在 https://www.youtube.com/watch?v=9ULzZA70Dzg 获取。 Evil Clippy 一款跨平台助手，用于创建恶意的MS Office文档。可以隐藏VBA宏、篡改VBA代码（通过P-code）并干扰宏分析工具。支持Linux、OSX和Windows。 如果你是初次接触该工具，建议先阅读我们关于Evil Clippy的博客文章：...

gollina

root@kitploit: $ gollina -h gollina Follina MS-MSDT 0-day MS Office RCE PoC in Go -- @dwisiswant0 Usage: gollina -c COMMAND OPTIONS... Options: -h, --host Listener host default: 0.0.0.0 -p, --port Listener port default: 8090 -n, --name Word file name w/o extension, default: gollina -c, --command...

CVE-2017-11882

CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 研究: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about 补丁分析:...

CVE-2023-36884-MS-Office-HTML-RCE

CVE-2023-36884: 細工された文書によるMS Office HTML RCE 2023年7月11日、Microsoftは複数の活発に悪用されているリモートコード実行（RCE）脆弱性に対処するパッチを公開しました。この措置により、欧州および北米の組織を標的とした、Storm-0978として知られる脅威アクターによるフィッシングキャンペーンも明らかになりました。このキャンペーンの中心となったのはCVE-2023-36884として指定されたゼロデイ脆弱性であり、攻撃者はウクライナ世界会議（UWC）に関連する地政学的な誘引文書を用いて、巧妙に作成されたOffice Open...

CVE-2017-11882

CVE-2017-11882 43b 原脚本来自于 https://github.com/embedi/CVE-2017-11882 109b 原脚本来自于 https://github.com/unamer/CVE-2017-11882/ （膜一波，现在unamer的代码已经可以执行shellcode了） CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-118...

CVE-2017-11882

CVE-2017-11882 43b 原脚本来自于 https://github.com/embedi/CVE-2017-11882 109b 原脚本来自于 https://github.com/unamer/CVE-2017-11882/ （膜一波，现在unamer的代码已经可以执行shellcode了） CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-118...

CVE-2017-11882

CVE-2017-11882 43b 原脚本来自于 https://github.com/embedi/CVE-2017-11882 109b 原脚本来自于 https://github.com/unamer/CVE-2017-11882/ （膜一波，现在unamer的代码已经可以执行shellcode了） CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-118...

CVE-2018-0802_CVE-2017-11882

RTF118820802 CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 研究: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about 补丁分析:...

macro_pack

macropack 概要 警告: MacroPack は 2021 年以降メンテナンスされていません。プロフェッショナルで、初期アクセス、侵害の想定、EDR バイパスのための攻撃的セキュリティツールが必要な場合は、https://www.balliskit.com を確認してください。 MacroPack Community は、MS Office ドキュメントや VBS のようなレトロな形式の難読化と生成を自動化するツールです。 また、さまざまなショートカット形式も処理します。 このツールは、レッドチーム演習、ペネトレーションテスト、デモ、ソーシャルエンジニアリング評価に使用できます。...

macro_pack

macropack Short description Warning: MacroPack is not maintained since 2021, if you are a pro and need Offensive infosec tools for initial access, assume breach, EDR bypass, check https://www.balliskit.com MacroPack Community is a tool used to automatize obfuscation and generation of retro format...

EUVD-2020-21916

Malware in sbrugna...

CVE-2020-29550

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account used for the connection of the MS Office 365 Integration Service is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext:...

SmokeLoader Malware Exploits MS Office Flaws to Steal Browser Credentials

SmokeLoader malware has resurfaced with enhanced capabilities and functionalities, targeting your personal data...

Hackers Use MS Excel Macro to Launch Multi-Stage Malware Attack in Ukraine

A new sophisticated cyber attack has been observed targeting endpoints geolocated to Ukraine with an aim to deploy Cobalt Strike and seize control of the compromised hosts. The attack chain, per Fortinet FortiGuard Labs, involves a Microsoft Excel file that carries an embedded VBA macro to initia...

PHPJabbers Shuttle Booking Software 2.0 CSV Injection

Exploit Title: PHPJabbers Shuttle Booking Software v2.0 - CSV Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/shuttle-booking-software/ Version: v2.0 Tested on: Windows 10...

PHPJabbers Car Rental 3.0 CSV Injection

Exploit Title: PHPJabbers Car Rental v3.0 - CSV Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-rental-script/ Version: v3.0 Tested on: Windows 10, Windows 11, MS Offi...

[SECURITY] [DLA 3426-3] netatalk regression update

Debian LTS Advisory DLA-3426-3 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 13, 2023 https://wiki.debian.org/LTS Package : netatalk Version : 3.1.12ds-3+deb10u3 CVE ID : CVE-2022-23123 Debian Bug : 1043504 Another regression was identified in Netatalk, t...

Office application installation when using a Citrix Workspace App version higher than 2107

When launching the first MS Office Pro Plus 2016 application in a session, a partial installation is ran...

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Vinay Kumar and Chintan Shah · July 19, 2022 Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned CVE-2022-30190 in Microsof...

URVE Software Build 24.03.2020 Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-042 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Cleartext Storage of Sensitive Information CWE-312 Exposure of Sensitive...